CLF-C02 Security and Compliance Practice Question
A security team needs to demonstrate to auditors that no AWS infrastructure has been modified between two audit periods. Which AWS service provides a continuous record of configuration changes with before-and-after state for all resources?
⚠ Common exam trap
Watch out — candidates often confuse AWS CloudTrail (which logs API calls) with AWS Config (which records resource configuration states), but CloudTrail does not provide the before-and-after configuration state that auditors require for demonstrating no infrastructure changes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config is the correct service because it continuously records configuration changes to AWS resources and provides a detailed history of each change, including the before-and-after state. This allows the security team to demonstrate to auditors that no infrastructure modifications occurred between two audit periods by reviewing the configuration timeline and compliance snapshots.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail is the governance service that records API actions performed on your account, including who made the call, from which IP address, and when. However, CloudTrail captures the action taken, not the resulting configuration item — it does not provide the resource's full prior or post-change state, such as every tag, security group rule, or IAM policy detail. This is why a change audit requires AWS Config to correlate the recorded call with the actual resource state at that moment.
- ✓
AWS Config
Why this is correct
AWS Config is purpose-built for configuration auditing because it continuously records and evaluates the state of supported AWS resources as configuration items. Each configuration item is stored with a version ID, a timestamp, and the complete JSON representation of the resource, enabling auditors to replay how the resource looked before and after any change. Config also supports rules for compliance checks and can deliver configuration snapshots to an S3 bucket for long-term retention, making it the definitive service for infrastructure change history.
- ✗
Amazon CloudWatch
Why it's wrong here
Amazon CloudWatch is a monitoring service for collecting metrics, logs, and events from AWS resources and applications. It stores operational telemetry with time-series data for alarms and dashboards, but it does not maintain a detailed, timestamped history of resource definitions or configuration states. Thus, while CloudWatch indicates whether a resource is healthy, it cannot serve as an authoritative audit source for configuration changes over time.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a continuous security monitoring service that uses threat intelligence and machine learning to detect malicious activity, such as unusual API access patterns, cryptocurrency mining, or compromised credentials. It produces security findings and alerts for operational responders, but it does not generate a chronological configuration history or expose resource state before and after a modification. For an infrastructure audit, GuardDuty tells you what suspicious behavior occurred, not how a resource was configured at a given point.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.